uluka 0.1.0__tar.gz

uluka-0.1.0/PKG-INFO

@@ -0,0 +1,38 @@
+Metadata-Version: 2.4
+Name: uluka
+Version: 0.1.0
+Summary: Install and open the Uluka Mac app (owner-approved accounts)
+Author: UlukaLabs
+License-Expression: LicenseRef-Proprietary
+Project-URL: Homepage, https://ulukalabs.com
+Classifier: Operating System :: MacOS
+Classifier: Environment :: MacOS X
+Classifier: Programming Language :: Python :: 3
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+
+# uluka
+
+The Uluka terminal: a coding and data agent running the Uluka 26B model on your
+own Mac, for owner-approved accounts.
+
+```
+pipx install uluka        # or: python3 -m pip install uluka
+uluka
+```
+
+The first time, `uluka` opens your browser to connect this Mac: sign in with an
+approved account, check that the device code matches, and choose
+**Allow this Mac**. It then downloads the signed, encrypted release once
+(about 9 GB; an interrupted download continues where it stopped), checks it and
+opens the Uluka terminal in the same window. Later runs check that your account
+is still approved and open the terminal; new releases install themselves.
+`uluka login` signs this Mac in again.
+
+Requirements: an Apple silicon Mac with macOS 14 or newer, 16 GB of memory and
+about 20 GB of free space while installing. Access requires an approved
+account: request it at https://ulukalabs.com/app.
+
+This package contains only the sign-in and setup. The terminal and the model
+arrive in the signed release; the model stays encrypted on disk and is unlocked
+only while your account is approved.

uluka-0.1.0/README.md

@@ -0,0 +1,25 @@
+# uluka
+
+The Uluka terminal: a coding and data agent running the Uluka 26B model on your
+own Mac, for owner-approved accounts.
+
+```
+pipx install uluka        # or: python3 -m pip install uluka
+uluka
+```
+
+The first time, `uluka` opens your browser to connect this Mac: sign in with an
+approved account, check that the device code matches, and choose
+**Allow this Mac**. It then downloads the signed, encrypted release once
+(about 9 GB; an interrupted download continues where it stopped), checks it and
+opens the Uluka terminal in the same window. Later runs check that your account
+is still approved and open the terminal; new releases install themselves.
+`uluka login` signs this Mac in again.
+
+Requirements: an Apple silicon Mac with macOS 14 or newer, 16 GB of memory and
+about 20 GB of free space while installing. Access requires an approved
+account: request it at https://ulukalabs.com/app.
+
+This package contains only the sign-in and setup. The terminal and the model
+arrive in the signed release; the model stays encrypted on disk and is unlocked
+only while your account is approved.

uluka-0.1.0/pyproject.toml

@@ -0,0 +1,27 @@
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "uluka"
+dynamic = ["version"]
+description = "Install and open the Uluka Mac app (owner-approved accounts)"
+readme = "README.md"
+requires-python = ">=3.9"
+license = "LicenseRef-Proprietary"
+authors = [{ name = "UlukaLabs" }]
+dependencies = []
+classifiers = [
+    "Operating System :: MacOS",
+    "Environment :: MacOS X",
+    "Programming Language :: Python :: 3",
+]
+
+[project.urls]
+Homepage = "https://ulukalabs.com"
+
+[project.scripts]
+uluka = "ulukalabs.cli:main"
+
+[tool.setuptools.dynamic]
+version = { attr = "ulukalabs.__version__" }

uluka-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

uluka-0.1.0/src/uluka.egg-info/PKG-INFO

@@ -0,0 +1,38 @@
+Metadata-Version: 2.4
+Name: uluka
+Version: 0.1.0
+Summary: Install and open the Uluka Mac app (owner-approved accounts)
+Author: UlukaLabs
+License-Expression: LicenseRef-Proprietary
+Project-URL: Homepage, https://ulukalabs.com
+Classifier: Operating System :: MacOS
+Classifier: Environment :: MacOS X
+Classifier: Programming Language :: Python :: 3
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+
+# uluka
+
+The Uluka terminal: a coding and data agent running the Uluka 26B model on your
+own Mac, for owner-approved accounts.
+
+```
+pipx install uluka        # or: python3 -m pip install uluka
+uluka
+```
+
+The first time, `uluka` opens your browser to connect this Mac: sign in with an
+approved account, check that the device code matches, and choose
+**Allow this Mac**. It then downloads the signed, encrypted release once
+(about 9 GB; an interrupted download continues where it stopped), checks it and
+opens the Uluka terminal in the same window. Later runs check that your account
+is still approved and open the terminal; new releases install themselves.
+`uluka login` signs this Mac in again.
+
+Requirements: an Apple silicon Mac with macOS 14 or newer, 16 GB of memory and
+about 20 GB of free space while installing. Access requires an approved
+account: request it at https://ulukalabs.com/app.
+
+This package contains only the sign-in and setup. The terminal and the model
+arrive in the signed release; the model stays encrypted on disk and is unlocked
+only while your account is approved.

uluka-0.1.0/src/uluka.egg-info/SOURCES.txt

@@ -0,0 +1,11 @@
+README.md
+pyproject.toml
+src/uluka.egg-info/PKG-INFO
+src/uluka.egg-info/SOURCES.txt
+src/uluka.egg-info/dependency_links.txt
+src/uluka.egg-info/entry_points.txt
+src/uluka.egg-info/top_level.txt
+src/ulukalabs/__init__.py
+src/ulukalabs/__main__.py
+src/ulukalabs/cli.py
+tests/test_cli.py

uluka-0.1.0/src/uluka.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

uluka-0.1.0/src/uluka.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+uluka = ulukalabs.cli:main

uluka-0.1.0/src/uluka.egg-info/top_level.txt

@@ -0,0 +1 @@
+ulukalabs

uluka-0.1.0/src/ulukalabs/__init__.py

@@ -0,0 +1,2 @@
+"""Installer and launcher for the Uluka Mac app (`pip install uluka`, then `uluka`)."""
+__version__ = "0.1.0"

uluka-0.1.0/src/ulukalabs/__main__.py

@@ -0,0 +1,5 @@
+import sys
+
+from .cli import main
+
+sys.exit(main())

uluka-0.1.0/src/ulukalabs/cli.py

@@ -0,0 +1,352 @@
+"""Open the Uluka terminal for an owner-approved account.
+
+    pipx install uluka        (or: python3 -m pip install uluka)
+    uluka                     sign in if needed, install or update Uluka, open the terminal
+    uluka login               sign this Mac in again
+
+This package holds no Uluka code. Signing in is the app's own "Allow this Mac" approval in the browser; the
+terminal, its agent and the encrypted model come in the signed release, which only an approved, signed-in Mac
+can download. The release is checked (size, SHA-256, code signature) before it is installed, and the terminal
+checks the release's signed files and the account's approval every time it starts. Uses only Python and macOS.
+"""
+from __future__ import annotations
+
+import base64
+import hashlib
+import http.client
+import json
+import os
+import platform
+import plistlib
+import re
+import shutil
+import socket
+import ssl
+import subprocess
+import sys
+import time
+import urllib.error
+import urllib.request
+import webbrowser
+from pathlib import Path
+
+from . import __version__
+
+ORIGIN = "https://ulukalabs.com"
+OPENSSL = "/usr/bin/openssl"
+CACHE = Path.home() / "Library" / "Caches" / "Uluka"
+CHUNK = 8 * 2**20
+LOGIN_SECONDS = 600
+HEX64 = re.compile(r"[0-9a-f]{64}")
+NETWORK_ERRORS = (urllib.error.URLError, http.client.HTTPException, ConnectionError, TimeoutError, socket.timeout)
+# Run by the app's own bundled Python, so the macOS Keychain treats the item as the app's (no access prompt).
+# Only the credential comes back out; the device's private key never leaves the app's Keychain item.
+KEYCHAIN_GET = ("import sys, json; sys.path.insert(0, sys.argv[1]); from app.model_license import MacKeychain; "
+                "i = MacKeychain().get(); print(json.dumps(i and {'credential': i['credential'], 'expiresAt': i['expiresAt']}))")
+KEYCHAIN_PUT = ("import sys, json; sys.path.insert(0, sys.argv[1]); from app.model_license import MacKeychain; "
+                "MacKeychain().put(json.load(sys.stdin))")
+TERMINAL = "import sys; sys.path.insert(0, sys.argv.pop(1)); from uluka.cli import main; raise SystemExit(main())"
+USAGE = __doc__.split("\n\n")[1]
+
+
+class Fail(Exception):
+    """A message for the person at the terminal."""
+
+
+class SignInAgain(Exception):
+    """The saved credential was refused: the Mac must be approved again."""
+
+
+class _NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, *args, **kwargs):
+        return None   # a redirect is an error: the device credential is never sent anywhere else
+
+
+_OPENER = None
+
+
+def _opener():
+    """No proxies (as in the app), no redirects, and macOS's root certificates whichever Python runs this
+    (python.org builds ship without a CA bundle)."""
+    global _OPENER
+    if _OPENER is None:
+        context = ssl.create_default_context()
+        roots = subprocess.run(["security", "find-certificate", "-a", "-p",
+                                "/System/Library/Keychains/SystemRootCertificates.keychain"],
+                               capture_output=True, text=True).stdout
+        if roots:
+            context.load_verify_locations(cadata=roots)
+        _OPENER = urllib.request.build_opener(urllib.request.ProxyHandler({}), _NoRedirect,
+                                              urllib.request.HTTPSHandler(context=context))
+    return _OPENER
+
+
+def http(method, path, *, data=None, headers=None, timeout=60):
+    body = None if data is None else json.dumps(data).encode()
+    request = urllib.request.Request(ORIGIN + path, data=body, method=method, headers={
+        "User-Agent": f"uluka/{__version__}", **({"Content-Type": "application/json"} if body else {}),
+        **(headers or {})})
+    return _opener().open(request, timeout=timeout)
+
+
+def call(method, path, data=None):
+    """A JSON request -> (status, body). HTTP error statuses are returned, not raised."""
+    try:
+        with http(method, path, data=data) as response:
+            return response.status, json.load(response)
+    except urllib.error.HTTPError as exc:
+        try:
+            return exc.code, json.load(exc)
+        except ValueError:
+            return exc.code, {}
+    except NETWORK_ERRORS as exc:
+        raise Fail(f"Could not reach {ORIGIN}: {getattr(exc, 'reason', exc)}") from exc
+
+
+def check_mac():
+    release = platform.mac_ver()[0]
+    if sys.platform != "darwin" or platform.machine() != "arm64":
+        raise Fail("Uluka runs on Apple silicon Macs for now. Windows and Linux are coming later.")
+    if int(release.split(".")[0] or 0) < 14:
+        raise Fail(f"Uluka needs macOS 14 or newer (this Mac has {release}).")
+
+
+def latest():
+    status, body = call("GET", "/api/releases")
+    mac = next((r for r in body.get("releases", []) if r.get("platform") == "macos"), None) if status == 200 else None
+    if not mac or not mac.get("available"):
+        raise Fail("No Mac release is available right now.")
+    if not HEX64.fullmatch(str(mac.get("sha256"))) or type(mac.get("bytes")) is not int \
+            or not re.fullmatch(r"[A-Za-z0-9._-]{1,160}\.dmg", str(mac.get("filename"))):
+        raise Fail("The release information looks wrong. Try again later.")
+    return mac
+
+
+def find_app():
+    """The installed app, or None. A drag-installed /Applications copy is the one kept up to date."""
+    return next((app for app in (Path("/Applications/Uluka.app"), Path.home() / "Applications" / "Uluka.app")
+                 if app.is_dir()), None)
+
+
+def default_target():
+    return Path("/Applications/Uluka.app") if os.access("/Applications", os.W_OK) \
+        else Path.home() / "Applications" / "Uluka.app"
+
+
+def installed_version(app):
+    try:
+        return json.loads((app / "Contents" / "Resources" / "release-manifest.json").read_bytes()).get("version")
+    except (OSError, ValueError):
+        return None
+
+
+def running(app):
+    return subprocess.run(["pgrep", "-f", f"{app}/Contents/"], capture_output=True).returncode == 0
+
+
+def keychain(app, code, identity=None):
+    """Run KEYCHAIN_GET / KEYCHAIN_PUT inside the installed app's runtime."""
+    resources = app / "Contents" / "Resources"
+    result = subprocess.run([str(resources / "runtime" / "python" / "bin" / "python3"), "-I", "-B", "-c", code,
+                             str(resources)], input=json.dumps(identity) if identity else "",
+                            capture_output=True, text=True, timeout=120)
+    if code is KEYCHAIN_GET:
+        return json.loads(result.stdout or "null") if result.returncode == 0 else None   # unreadable: sign in again
+    if result.returncode != 0:
+        raise Fail("Uluka could not save its sign-in to the Keychain. Unlock your login keychain, then open Uluka.")
+    return None
+
+
+def keypair():
+    """A 3072-bit RSA device key, as the app makes it: PKCS#8 private DER and base64 SPKI public DER."""
+    private = subprocess.run([OPENSSL, "genpkey", "-algorithm", "RSA", "-pkeyopt", "rsa_keygen_bits:3072",
+                              "-outform", "DER"], capture_output=True, check=True).stdout
+    public = subprocess.run([OPENSSL, "pkey", "-inform", "DER", "-pubout", "-outform", "DER"], input=private,
+                            capture_output=True, check=True).stdout
+    return private, base64.b64encode(public).decode()
+
+
+def sign_in():
+    """The app's device approval: the owner-approved account allows this Mac in the browser."""
+    private, public = keypair()
+    status, start = call("POST", "/api/model/start", {"publicKey": public})
+    if status != 201:
+        raise Fail(start.get("error") or f"Mac sign-in could not start (HTTP {status}).")
+    fingerprint = str(start.get("fingerprint"))
+    if fingerprint != hashlib.sha256(public.encode()).hexdigest() or not HEX64.fullmatch(str(start.get("id"))) \
+            or not HEX64.fullmatch(str(start.get("code"))):
+        raise Fail("Mac sign-in returned an unexpected answer.")
+    url = f"{ORIGIN}/app?macDevice={start['id']}#download"   # built here, never taken from the server
+    print("Connect this Mac to Uluka", file=sys.stderr)
+    print(f"  Device code: {' '.join(fingerprint[i:i + 4] for i in range(0, 16, 4))}", file=sys.stderr)
+    print("  Sign in with your approved account, check the code matches, then choose Allow this Mac.", file=sys.stderr)
+    print(f"  If no browser opened: {url}", file=sys.stderr)
+    webbrowser.open(url)
+    deadline = time.monotonic() + LOGIN_SECONDS
+    while time.monotonic() < deadline:
+        time.sleep(4)
+        status, result = call("POST", "/api/model/poll", {"code": start["code"]})
+        if status in (202, 429):
+            continue
+        if status == 200 and HEX64.fullmatch(str(result.get("credential"))) and type(result.get("expiresAt")) is int:
+            print("Signed in.", file=sys.stderr)
+            return {"privateKey": base64.b64encode(private).decode(), "credential": result["credential"],
+                    "expiresAt": result["expiresAt"]}
+        if status == 403:
+            raise Fail("This account is not approved for Uluka yet. Request access at https://ulukalabs.com/app")
+        raise Fail(result.get("error") or "Sign-in did not finish. Run uluka again.")
+    raise Fail("Sign-in timed out after 10 minutes. Run uluka again.")
+
+
+def download(release, credential):
+    """Resumable download of the release into CACHE, verified against the published size and SHA-256."""
+    CACHE.mkdir(parents=True, exist_ok=True)
+    target = CACHE / release["filename"]
+    part = target.with_name(target.name + ".part")
+    for stale in CACHE.glob("*.dmg*"):
+        if stale not in (target, part):
+            stale.unlink()
+    size, digest = release["bytes"], hashlib.sha256()
+    have = part.stat().st_size if part.exists() else 0
+    if have > size:
+        part.unlink()
+        have = 0
+    with part.open("ab") as out:
+        if have:
+            with part.open("rb") as previous:
+                for block in iter(lambda: previous.read(CHUNK), b""):
+                    digest.update(block)
+        if shutil.disk_usage(CACHE).free < (size - have) + size + 2 * 2**30:
+            raise Fail(f"Free up space first: installing needs about {2 * size / 1e9:.0f} GB.")
+        failures, shown = 0, 0.0
+        while have < size:
+            headers = {"Authorization": f"Uluka-Device {credential}"}
+            if have:
+                headers["Range"] = f"bytes={have}-"
+            try:
+                with http("GET", "/api/download/macos", headers=headers) as response:
+                    if have and response.status != 206:
+                        raise Fail("The server did not resume the download. Run uluka again.")
+                    for block in iter(lambda: response.read(CHUNK), b""):
+                        out.write(block)
+                        digest.update(block)
+                        have += len(block)
+                        if time.monotonic() - shown > 0.5 or have == size:
+                            shown = time.monotonic()
+                            print(f"\rDownloading Uluka {release['version']}: {have / 1e9:.2f} of {size / 1e9:.2f} GB "
+                                  f"({100 * have // size}%)", end="", file=sys.stderr, flush=True)
+            except urllib.error.HTTPError as exc:
+                if exc.code == 401:
+                    raise SignInAgain() from exc
+                if exc.code == 403:
+                    raise Fail("This account is not approved for Uluka downloads.") from exc
+                raise Fail(f"The download failed (HTTP {exc.code}). Run uluka again to resume.") from exc
+            except NETWORK_ERRORS as exc:
+                failures += 1
+                if failures > 5:
+                    raise Fail("The download keeps failing. Run uluka again to resume.") from exc
+                time.sleep(min(30, 2 ** failures))
+    print(file=sys.stderr)
+    if have != size or digest.hexdigest() != release["sha256"]:
+        part.unlink()
+        raise Fail("The download did not match the published checksum and was deleted. Run uluka again.")
+    part.replace(target)
+    return target
+
+
+def install(dmg, target, version):
+    """Copy Uluka.app out of the verified disk image, replacing the installed copy only once it is complete."""
+    attached = plistlib.loads(subprocess.run(["hdiutil", "attach", "-readonly", "-nobrowse", "-noautoopen", "-plist",
+                                              str(dmg)], capture_output=True, check=True).stdout)
+    mount = next(Path(e["mount-point"]) for e in attached["system-entities"] if "mount-point" in e)
+    try:
+        source = mount / "Uluka.app"
+        if subprocess.run(["codesign", "--verify", "--deep", "--strict", str(source)],
+                          capture_output=True).returncode != 0:
+            raise Fail("The downloaded app failed its code signature check.")
+        if installed_version(source) != version:
+            raise Fail("The disk image does not hold the published version.")
+        print("Installing…", file=sys.stderr)
+        target.parent.mkdir(parents=True, exist_ok=True)
+        staging, old = target.with_name(".Uluka.app.installing"), target.with_name(".Uluka.app.old")
+        for path in (staging, old):
+            shutil.rmtree(path, ignore_errors=True)
+        subprocess.run(["ditto", str(source), str(staging)], check=True)
+        if target.exists():
+            target.rename(old)
+        staging.rename(target)
+        shutil.rmtree(old, ignore_errors=True)
+    finally:
+        subprocess.run(["hdiutil", "detach", str(mount)], capture_output=True)
+
+
+def update(app, release):
+    """Install `release` at the app's place (or the default one). Returns the installed app."""
+    target = app or default_target()
+    if app and running(app):
+        raise Fail("Quit Uluka, then run uluka again to update it.")
+    saved = keychain(app, KEYCHAIN_GET) if app else None
+    fresh = None
+    credential = saved["credential"] if saved and saved.get("expiresAt", 0) > time.time() else None
+    for _ in range(2):
+        if credential is None:
+            fresh = sign_in()
+            credential = fresh["credential"]
+        try:
+            dmg = download(release, credential)
+            break
+        except SignInAgain:
+            if fresh is not None:
+                raise Fail("The new sign-in was refused. Run uluka again.") from None
+            credential = None
+    install(dmg, target, release["version"])
+    dmg.unlink()
+    if fresh is not None:
+        keychain(target, KEYCHAIN_PUT, fresh)   # the app starts signed in: one approval per Mac
+    print(f"Uluka {release['version']} is installed at {target}.", file=sys.stderr)
+    return target
+
+
+def signed_in(app):
+    saved = keychain(app, KEYCHAIN_GET)
+    return bool(saved) and saved.get("expiresAt", 0) > time.time()
+
+
+def open_terminal(app, args):
+    """Replace this process with the terminal inside the installed release (compiled, with its own Python)."""
+    import resource
+    resources = app / "Contents" / "Resources"
+    python = resources / "runtime" / "python" / "bin" / "python3"
+    resource.setrlimit(resource.RLIMIT_CORE, (0, 0))   # as the app's launcher: no memory dumps of the model
+    env = dict(os.environ, HF_HUB_OFFLINE="1", TRANSFORMERS_OFFLINE="1",
+               PLAYWRIGHT_BROWSERS_PATH=str(resources / "browsers"))
+    os.execve(python, [str(python), "-I", "-B", "-c", TERMINAL, str(resources), *args], env)
+
+
+def main(argv=None):
+    args = list(sys.argv[1:] if argv is None else argv)
+    if args[:1] == ["--installer-version"]:
+        print(f"uluka installer {__version__}")
+        return 0
+    try:
+        check_mac()
+        app = find_app()
+        if app is None and args[:1] in (["-h"], ["--help"]):
+            print(USAGE)
+            return 0
+        release = latest()
+        if app is None or installed_version(app) != release["version"]:
+            app = update(app, release)                       # signs in first when needed
+        login = args[:1] == ["login"]
+        if login or not signed_in(app):
+            keychain(app, KEYCHAIN_PUT, sign_in())
+        if login:
+            return 0
+        open_terminal(app, args)
+    except Fail as exc:
+        print(f"\nuluka: {exc}", file=sys.stderr)
+        return 1
+    except KeyboardInterrupt:
+        print("\nuluka: stopped. Run uluka again to continue where it left off.", file=sys.stderr)
+        return 130
+    return 0

uluka-0.1.0/tests/test_cli.py

@@ -0,0 +1,165 @@
+"""The launcher against a local stand-in for ulukalabs.com: sign-in, resumable verified download, install.
+
+    python -m pytest launcher/tests      (macOS: uses openssl, hdiutil, codesign and ditto)
+"""
+import hashlib
+import json
+import plistlib
+import subprocess
+import sys
+import threading
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
+sys.path.insert(0, str(Path(__file__).resolve().parents[2] / "release" / "macos"))
+from ulukalabs import cli  # noqa: E402
+
+pytestmark = pytest.mark.skipif(sys.platform != "darwin", reason="macOS tools")
+PAYLOAD = bytes(range(256)) * 4096 + b"tail"      # ~1 MiB stands in for the disk image
+CREDENTIAL = "c" * 64
+
+
+class Site:
+    """Just enough of the Worker: releases, the device sign-in and the device-authorized download."""
+
+    def __init__(self, payload=PAYLOAD, published=None):
+        self.payload, self.polls, self.requests = payload, 0, []
+        self.sha = published or hashlib.sha256(payload).hexdigest()
+        site = self
+
+        class Handler(BaseHTTPRequestHandler):
+            def log_message(self, *args):
+                pass
+
+            def reply(self, status, body=b"", headers=None):
+                self.send_response(status)
+                for k, v in (headers or {}).items():
+                    self.send_header(k, v)
+                self.send_header("Content-Length", str(len(body)))
+                self.end_headers()
+                self.wfile.write(body)
+
+            def do_GET(self):
+                site.requests.append((self.path, dict(self.headers)))
+                if self.path == "/api/releases":
+                    return self.reply(200, json.dumps({"releases": [{"platform": "macos", "available": True,
+                        "version": "9.9", "filename": "Uluka-test.dmg", "bytes": len(site.payload),
+                        "sha256": site.sha}]}).encode())
+                if self.headers.get("Authorization") != f"Uluka-Device {CREDENTIAL}" or "Origin" in self.headers:
+                    return self.reply(401)
+                rng = self.headers.get("Range")
+                if rng:
+                    start = int(rng.split("=")[1].rstrip("-"))
+                    return self.reply(206, site.payload[start:])
+                return self.reply(200, site.payload)
+
+            def do_POST(self):
+                body = json.loads(self.rfile.read(int(self.headers["Content-Length"])))
+                if self.path == "/api/model/start":
+                    site.public_key = body["publicKey"]
+                    return self.reply(201, json.dumps({"id": "a" * 64, "code": "b" * 64,
+                        "fingerprint": hashlib.sha256(body["publicKey"].encode()).hexdigest()}).encode())
+                site.polls += 1
+                if site.polls == 1:
+                    return self.reply(202, b'{"pending": true}')
+                return self.reply(200, json.dumps({"credential": CREDENTIAL, "expiresAt": 2_000_000_000}).encode())
+
+        self.server = ThreadingHTTPServer(("127.0.0.1", 0), Handler)
+        threading.Thread(target=self.server.serve_forever, daemon=True).start()
+        self.origin = f"http://127.0.0.1:{self.server.server_port}"
+
+
+@pytest.fixture
+def site(monkeypatch, tmp_path):
+    s = Site()
+    monkeypatch.setattr(cli, "ORIGIN", s.origin)
+    monkeypatch.setattr(cli, "CACHE", tmp_path / "cache")
+    monkeypatch.setattr(cli.time, "sleep", lambda _: None)
+    opened = []
+    monkeypatch.setattr(cli.webbrowser, "open", opened.append)
+    s.opened = opened
+    yield s
+    s.server.shutdown()
+
+
+def test_sign_in_makes_an_app_compatible_identity(site):
+    identity = cli.sign_in()
+    assert identity["credential"] == CREDENTIAL and site.polls == 2
+    assert site.opened == [f"{site.origin}/app?macDevice={'a' * 64}#download"]     # built locally
+    from cryptography.hazmat.primitives import serialization
+    import base64
+    private = serialization.load_der_private_key(base64.b64decode(identity["privateKey"]), None)
+    assert private.key_size == 3072
+    spki = private.public_key().public_bytes(serialization.Encoding.DER, serialization.PublicFormat.SubjectPublicKeyInfo)
+    assert base64.b64encode(spki).decode() == site.public_key                         # the key the site registered
+
+
+def test_download_resumes_and_verifies(site):
+    release = cli.latest()
+    part = cli.CACHE / "Uluka-test.dmg.part"
+    part.parent.mkdir(parents=True)
+    part.write_bytes(PAYLOAD[:1000])                                                   # an interrupted earlier run
+    dmg = cli.download(release, CREDENTIAL)
+    assert dmg.read_bytes() == PAYLOAD and not part.exists()
+    path, headers = site.requests[-1]
+    assert headers["Range"] == "bytes=1000-" and "Origin" not in headers
+
+
+def test_a_checksum_mismatch_is_deleted(site, monkeypatch):
+    monkeypatch.setattr(site, "sha", "0" * 64)
+    with pytest.raises(cli.Fail, match="checksum"):
+        cli.download(cli.latest(), CREDENTIAL)
+    assert not list(cli.CACHE.iterdir())
+
+
+def test_a_refused_credential_asks_for_sign_in(site):
+    with pytest.raises(cli.SignInAgain):
+        cli.download(cli.latest(), "d" * 64)
+
+
+def test_install_replaces_the_app_from_a_signed_image(tmp_path):
+    from disk_image import build_disk_image
+    app = tmp_path / "src" / "Uluka.app"
+    (app / "Contents" / "MacOS").mkdir(parents=True)
+    (app / "Contents" / "Resources").mkdir()
+    (app / "Contents" / "MacOS" / "Uluka").write_bytes(Path("/usr/bin/true").read_bytes())
+    (app / "Contents" / "MacOS" / "Uluka").chmod(0o755)
+    (app / "Contents" / "Resources" / "release-manifest.json").write_text('{"version": "9.9"}')
+    (app / "Contents" / "Info.plist").write_bytes(plistlib.dumps({"CFBundleIdentifier": "com.ulukalabs.test.launcher",
+                                                                  "CFBundleExecutable": "Uluka"}))
+    subprocess.run(["codesign", "--force", "--sign", "-", str(app)], check=True, capture_output=True)
+    dmg = build_disk_image(app, tmp_path / "Uluka.dmg")
+    target = tmp_path / "Applications" / "Uluka.app"
+    target.mkdir(parents=True)
+    (target / "old").write_text("previous install")
+    cli.install(dmg, target, "9.9")
+    assert cli.installed_version(target) == "9.9" and not (target / "old").exists()
+    assert not list(target.parent.glob(".Uluka.app.*"))
+    with pytest.raises(cli.Fail, match="published version"):
+        cli.install(dmg, target, "1.0")
+    assert cli.installed_version(target) == "9.9"                                     # a refused image changes nothing
+
+
+def test_the_terminal_replaces_the_installer_process(monkeypatch, tmp_path):
+    calls = []
+    monkeypatch.setattr(cli.os, "execve", lambda path, argv, env: calls.append((path, argv, env)))
+    import resource
+    monkeypatch.setattr(resource, "setrlimit", lambda *a: calls.append(("rlimit", a)))
+    app = tmp_path / "Uluka.app"
+    cli.open_terminal(app, ["--model", "26b"])
+    resources = app / "Contents" / "Resources"
+    python = resources / "runtime" / "python" / "bin" / "python3"
+    assert calls[0] == ("rlimit", (resource.RLIMIT_CORE, (0, 0)))
+    path, argv, env = calls[1]
+    assert path == python and argv == [str(python), "-I", "-B", "-c", cli.TERMINAL, str(resources), "--model", "26b"]
+    assert env["HF_HUB_OFFLINE"] == "1" and env["TRANSFORMERS_OFFLINE"] == "1"
+
+
+def test_help_before_install_downloads_nothing(monkeypatch, capsys):
+    monkeypatch.setattr(cli, "find_app", lambda: None)
+    monkeypatch.setattr(cli, "latest", lambda: pytest.fail("no network for --help"))
+    assert cli.main(["--help"]) == 0
+    assert "uluka login" in capsys.readouterr().out